Dispenser programming authorization system and method for fraud prevention

ABSTRACT

Methods and systems for preventing fraud by a customer at a fuel dispenser within a retail fueling environment are disclosed. According to one method, an authorization to access programming mode (AAPM) signal is received at the fuel dispenser from an authorization terminal coupled to the fuel dispenser. A request is received at the fuel dispenser to enter a programming mode of operation (PMO). The PMO is entered at the fuel dispenser to allow fuel dispenser settings of the fuel dispenser to be changed after receiving the AAPM signal and the request to enter the PMO.

CROSS-REFERENCE TO A RELATED APPLICATION

This application is a divisional application of copending applicationSer. No. 11/614,415, filed Dec. 21, 2006, which is incorporated fullyherein by reference.

FIELD OF THE INVENTION

The present invention relates to a system and method for controllingaccess to a programming mode for a fuel dispenser (FD) in a fuelingenvironment via an authorization to access programming mode (AAPM)signal.

BACKGROUND OF THE INVENTION

Fuel dispenser fraud is a problem that can result in significant lostrevenues annually within retail fueling environments. One method offraud occurs when persons wishing to perpetrate fraud place a fueldispenser into a programming mode of operation and program the fueldispenser to alter metrological functions or other associated parametersrelated to fuel dispensing. Once altered, the person may dispense fueleither at a reduced cost or by drive-off without any payment since anattendant will not be alerted to the dispensing activity.

In order to access a programming mode of operation for a fuel dispenserand make these changes, the perpetrator need only have keys to accessthe dispenser electronics cabinet and/or a hand held or otherprogramming device with an associated security code. Once the fueldispenser is placed into a programming mode, the perpetrator can eitherchange price per volume (e.g., liter or gallon), place the dispenser inan operating mode that does not require point-of-sale (POS)authorization to dispense fuel, calibrate the meters, or change othermetrological functions. For example, a perpetrator may arrive at a fueldispenser and place the dispenser into a programming mode without anattendant being aware of this activity. The perpetrator may then alterthe price per gallon/liter for fuel, dispense fuel at a reduced cost,and pay the attendant the reduced amount for the fuel. Alternatively,the perpetrator may place the fuel dispenser into a mode of operationthat does not alert the attendant to a request to dispense fuel. In thisscenario, the perpetrator may dispense fuel without the attendant evenrealizing that fuel has been dispensed.

Accordingly, there exists a need to provide fraud protection in a retailfueling environment including preventing a fuel dispenser from beingplaced into a programming mode of operation prior to it receiving anauthorization from authorized personnel to access programming mode(AAPM) signal from a POS device.

SUMMARY OF THE INVENTION

The present invention provides fraud protection within a retail fuelingenvironment by preventing a fuel dispenser (FD) from being placed into aprogramming mode of operation (PMO) prior to it receiving anauthorization to access programming mode (AAPM) signal from authorizedpersonnel via an authorization terminal. In one embodiment, theauthorization terminal includes a point-of-sale (POS) device and anattendant or technician issues the AAPM signal from the POS device whenprogramming of the FD is to be performed. Upon receipt of the AAPMsignal, the FD starts a timer. If the timer expires or a fuelingtransaction is initiated prior to the FD being placed into theprogramming mode, the FD will prevent entry into the programming mode.When the programming mode has been entered, the timer may be restarted.If the programming mode is not exited prior to expiration of the timeror if a transaction is initiated, the programming mode of operation willbe exited if the unit is programmed for a minimum access time.

In another embodiment, the authorization terminal includes a remotesystem and the AAPM signal is generated at a remote location, such as asite controller or a remote system coupled to the retail fuelingenvironment via a network.

In third embodiment, the authorization terminal includes a sitecontroller and the AAPM signal is generated via the site controller.

In a fourth embodiment, the authorization terminal includes a wirelessdevice and the AAPM signal is generated via the wireless device.

In a fifth embodiment, an augmented protocol may be associated with theAAPM signal to further enhance security and to verify that the AAPMsignal was actually generated by authorized personnel via one of the POSdevice, the site controller, or the remote system. The augmentedprotocol may be developed such that the AAPM signal is either led and/orfollowed by additional signaling from the generating device thatoriginated the AAPM signal. For example, a certain number (e.g., three)of pump stop signals (not described in detail herein) may be generatedafter the AAPM signal to further distinguish and identify the AAPMsignal generated at one of the POS device, the site controller, or theremote system.

In a sixth embodiment, biometrics associated with the authorizedpersonnel may be maintained, for example within a database, and used forauthorizing generation of the AAPM signal. This biometric authorizationmay also be documented on a per-authorization basis to record which ofthe authorized personnel changed the programming. Programming changesthat were made may also be recorded and associated with the biometricauthorization. Further, authorization requests may also be recorded whenno changes are made to the programming

Those skilled in the art will appreciate the scope of the presentinvention and realize additional aspects thereof after reading thefollowing detailed description of the preferred embodiments inassociation with the accompanying drawing figures.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawing figures incorporated in and forming a part ofthis specification illustrate several aspects of the invention, andtogether with the description serve to explain the principles of theinvention.

FIG. 1 is a schematic diagram of an exemplary retail service stationenvironment in accordance with disclosed embodiments of the presentinvention to increase fraud protection within the retail fuelingenvironment by preventing fuel dispensers from being placed into aprogramming mode of operation prior to receiving an authorization toaccess programming mode (AAPM) signal;

FIG. 2 illustrates a detailed view of an exemplary fuel dispenser (FD)that operates in conjunction with a point-of-sale (POS) device and/or asite controller (SC) within the retail fueling environment to providefraud protection by limiting access to a programming mode of operationfor the FD prior to receipt of the AAPM signal;

FIG. 3 illustrates a block diagram of an exemplary control systemassociated with a FD for controlling entry into a programming mode ofoperation in response to receipt of the AAPM signal;

FIG. 4 illustrates an exemplary process that may be executed on a POSdevice, an SC with a POS interface, a remote system, or a wirelessdevice to facilitate protection from fraud within a retail fuelingenvironment by providing the AAPM signal to a FD in response to an inputselection by the attendant or technician requesting that the AAPM signalbe generated; and

FIG. 5 illustrates an exemplary process that may be executed on a FD andthat responds to the AAPM signaling generated by the process of FIG. 4to facilitate protection from fraud within a retail fueling environmentby preventing the FD from being placed into the programming mode ofoperation at times other than during a window of time after receipt ofthe AAPM signal.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

The embodiments set forth below represent the necessary information toenable those skilled in the art to practice the invention and illustratethe best mode of practicing the invention. Upon reading the followingdescription in light of the accompanying drawing figures, those skilledin the art will understand the concepts of the invention and willrecognize applications of these concepts not particularly addressedherein. It should be understood that these concepts and applicationsfall within the scope of the disclosure and the accompanying claims.

The present invention provides fraud protection within a retail fuelingenvironment by preventing a fuel dispenser (FD) from being placed into aprogramming mode of operation prior to it receiving an authorization toaccess programming mode (AAPM) signal from authorized personnel via anauthorization terminal. In one embodiment, the authorization terminalincludes a point-of-sale (POS) device and an attendant or technicianissues the AAPM signal from the POS device when programming of the FD isto be performed. Upon receipt of the AAPM signal, the FD starts a timer.If the timer expires or a fueling transaction is initiated prior to theFD being placed into the programming mode, the FD will prevent entryinto the programming mode. When the programming mode has been entered,the timer is restarted. If the programming mode is not exited prior toexpiration of the timer or if a transaction is initiated, theprogramming mode of operation will be exited.

In another embodiment, the authorization terminal includes a remotesystem and the AAPM signal is generated at a remote location, such as asite controller or a remote system coupled to the retail fuelingenvironment via a network.

In a third embodiment, the authorization terminal includes a sitecontroller and the

AAPM signal is generated via the site controller.

In a fourth embodiment, the authorization terminal includes a wirelessdevice and the AAPM signal is generated via the wireless device.

In a fifth embodiment, an augmented protocol may be associated with theAAPM signal to further enhance security and to verify that the AAPMsignal was actually generated by authorized personnel via one of the POSdevice, the site controller, or the remote system. The augmentedprotocol may be developed such that the AAPM signal is either led and/orfollowed by additional signaling from the generating device thatoriginated the AAPM signal. For example, a certain number (e.g., three)of pump stop signals (not described in detail herein) may be generatedafter the AAPM signal to further distinguish and identify the AAPMsignal generated at one of the POS device, the site controller, or theremote system.

FIG. 1 is a schematic diagram of an exemplary retail fueling environment10 in accordance with disclosed embodiments of the present invention toincrease fraud protection within the retail fueling environment 10 bypreventing fuel dispensers from being placed into a programming mode ofoperation prior to receiving an authorization to access programming mode(AAPM) signal. The retail fueling environment 10 includes a centralbuilding 12, a plurality of fueling islands 14, each including multiplefuel dispensers (FDs) 16 having control systems 18 and manager's keypads20, and a car wash 22. The manager's keypads 20 are used to place theFDs 16 into a programming mode of operation. As will be described inmore detail below, the FDs 16 will prevent entry into a programming modeof operation prior to receipt of an AAPM signal and authorization toenter the programming mode of operation exists thereafter for theduration of a timer or until a transaction is started at the FD.

A wireless device 23 is illustrated within the retail fuelingenvironment 10. The wireless device 23 may be used by an attendant,technician, or other authorized personnel as an authorization terminalto generate the AAPM signal and any related signaling from a locationproximate to the FDs 16 to allow any of the FDs 16 to be placed into theprogramming mode of operation without the authorized person having torepeatedly travel between the central building 12 and the FDs 16 or torepeatedly request that a remote system generate the signaling, as willbe described in more detail below.

The central building 12 need not be centrally located within the retailfueling environment 10, but rather is the focus of the retail fuelingenvironment 10, and may house a convenience store 24 and/or a quickserve restaurant (QSR) 26 therein. Both the convenience store 24 and theQSR 26 may include point-of-sale (POS) devices 28 and 30, respectively.In addition to POS transaction processing, the POS devices 28 and 30 areused to generate the AAPM signal upon appropriate authorization and tosend that signal to the FDs 16 to allow the FDs 16 to be placed into aprogramming mode of operation.

The central building 12 further includes a site controller (SC) 32,which in an exemplary embodiment may be the G-SITE® sold by GilbarcoInc. of Greensboro, N.C. or other third party site controller. The SC 32may control the authorization of fueling transactions and otherconventional activities, as is well understood. The SC 32 may beincorporated into a POS device, such as the POS devices 28 and 30, ifneeded or desired, such that the SC 32 also acts as a POS device.

The SC 32 includes a database (DB) 34 capable of storing identificationand authorization indicia. This identification and authorization indiciamay be used to identify an individual making a programming request atany POS device, such as the POS devices 28 and 30, within the retailfueling environment 10. This identification of the individual mayinclude use of biometric information or other data. The identificationand authorization indicia may also be used to authenticate theprogramming request from that individual by use of passwords or otherinformation, such as an employee identification number or fingerprint,that may be entered at the POS terminal during a programming requestsequence. The identification and authentication indicia, such as thefingerprint or employee identification number, may also be documented ona per-authorization basis to record which of the authorized personnelchanged the programming. Programming changes that were made may also berecorded and associated with the programming request. Further,authorization requests may also be recorded when no changes are made tothe programming

Further, the SC 32 may have an off-site communication link 36 allowingcommunication with a remote location for credit/debit card authorizationvia a host processing system 38, an identification database 40, and/or aremote system 42. The identification database 40 can be used to remotelystore the information described above in association with the DB 34. Theremote system 42 represents another computer, system, or device that canbe used to access identification information, such as credit card and/orfingerprint data. The off-site communication link 36 may be routedthrough the Public Switched Telephone Network (PSTN), the Internet,both, or the like, as needed or desired.

It should be noted that the car wash 22, the convenience store 24, andthe QSR 26 are all optional and need not be present in a given retailfueling environment.

As described above, the plurality of fueling islands 14 may have one ormore FDs 16 positioned thereon. The FDs 16 and the POS terminals 28 and30 are in electronic communication with one another and with the SC 32through a Local Area Network (LAN), pump communication loop, or othercommunication channel or line, or the like.

The retail fueling environment 10 also has one or more undergroundstorage tanks (USTs) 44 adapted to hold fuel therein. As such, the USTs44 may be double-walled USTs. Further, each UST 44 may include a liquidlevel sensor or other sensor (not shown) positioned therein. The sensorsmay report to a tank monitor (TM) 46 associated therewith. The TM 46 maycommunicate with the FDs 16 (either through the SC 32 or directly, asneeded or desired) to determine amounts of fuel dispensed, and comparefuel dispensed to current levels of fuel within the USTs 44 to determineif the USTs 44 are leaking. In a typical installation, the TM 46 is alsopositioned in the central building 12, and may be proximate to the SC32. The TM 46 may communicate with the SC 32 for leak detectionreporting, inventory reporting, or the like.

FIG. 2 illustrates a detailed view of an exemplary FD 16 that operatesin conjunction with any of the POS devices 28 and 30, and/or the SC 32,within the retail fueling environment 10 to provide fraud protection bylimiting access to a programming mode of operation for the FD 16 priorto receipt of the AAPM signal. The FD 16 includes the control system 18and manager's keypad 20 described above. The manager's keypad 20 is usedto place the control system 18 of the FD 16 into a programming mode ofoperation. The control system 18 will prevent entry into a programmingmode of operation prior to receipt of an AAPM signal.

The FD 16 has a base 60 and a top 62, with a canopy 64 supported by twoside panels 66. The FD 16 is subdivided into multiple compartments. Ahydraulic area 68 is used to enclose hydraulic components and anelectronic area 70 is used to enclose electronic components. A vaporbarrier (not shown) may be used to separate the hydraulic area 68 fromthe electronic area 70.

Several components used to control fuel flow may be housed within thehydraulic area 68. Fuel from USTs 44 (FIG. 1) is pumped through a pipingnetwork into inlet or fuel dispensing pipes. An inlet pipe 72 provides apiping network from an UST.

When fuel is dispensed, fuel begins to travel through a meter 74, whichis responsive to flow rate or volume. A pulser 76 is employed togenerate a signal in response to fuel movement through the meter 74.Control/data lines 78 provide a signaling path from the pulser 76 to thecontrol system 18. The control/data lines 78 provide signals to thecontrol system 18 indicative of the flow rate or volume of fuel beingdispensed within the meter 74. The control/data lines 78 may providecontrol signaling to a valve 80 that may be opened and closed todispense and terminate dispensing of fuel, respectively.

The control system 18 includes a controller and control circuitry (notshown) for controlling access to a programming mode of operation, aswill be described in more detail below. The control system 18 alsocontrols transaction-level and functional processing within the FD 16 bycollecting meter flow measurements from the pulser 76, performingcalibration operations associated with the meter 74, and performingcalculations such as cost associated with a fuel dispensing transaction.Additionally, the control system 18 controls transactional processing atthe FD 16, as will be described in more detail below.

As fuel is dispensed from the FD 16, the control system 18 receivessignaling from the pulser 76 associated with the meter 74 describedabove during the dispensing transaction. In response to receipt ofsignaling from the pulser 76, the control system 18 providestransaction-level functionality within the FD 16. The control system 18collects, either directly or indirectly, meter flow measurementsassociated with the meter 74.

As a dispensing transaction progresses, fuel is then delivered to a hose82 and through a nozzle 84 into the customer's vehicle (not shown). TheFD 16 includes a nozzle boot 86, which may be used to hold and retainthe nozzle 84 when not in use. The nozzle boot 86 may include amechanical or electronic switch (not shown) to indicate when the nozzle84 has been removed for a fuel dispensing request and when the nozzle 84has been replaced, signifying the end of a fueling transaction. Acontrol line (not shown) provides a signaling path from the electronicswitch to the control system 18. The control system 18 uses signalingreceived via the control line in order to make a determination as towhen a transaction has been initiated or completed.

The control system 18 uses control/data lines 88 to interface to a userinterface 90 that includes various combinations of subsystems tofacilitate customer interaction with the FD 16. The user interface 90may include a keypad 92. The keypad 92 may be used for selection ofdifferent types of purchase transactions available to the customer or toenter an authentication code. The keypad 92 may also be used for entryof a personal identification number (PIN) if the customer is using adebit card for payment of fuel or other goods or services.

The user interface 90 may also contain a magnetic strip card reader 94for insertion of credit, debit or other magnetic strip cards forpayment. Additionally, the magnetic strip card reader 94 may acceptloyalty or program-specific cards that entitle the customer to a fixedcredit or percentage discount or other favorable pricing on fuel orother goods/services.

The user interface 90 may also include a radio-frequency (RF) antenna96. The RF antenna 96 is coupled to an RF interrogator (not shown). Ifthe customer is tendering a radio frequency identifier (RFID) forpayment of a car wash, the RF antenna 96, as controlled by the RFinterrogator, will generate a field to interrogate the customer's RFID.The RFID and the RF antenna 96 will communicate using RF communicationsto identify the customer's account or other payment information. Formore information on RFID payments and interaction at a FD, see U.S. Pat.No. 6,073,840, entitled “Fuel Dispensing and Retail System Providing forTransponder Prepayment,” issued Jun. 13, 2000, which is incorporatedherein by reference in its entirety.

The user interface 90 may also include other payment or transactionaldevices to receive payment information for transaction processingassociated with transactions, including a bill acceptor 98, an opticalreader 100, a smart card reader 102, and a biometric reader 104. Theuser interface 90 also includes a receipt printer 106 so that a receiptwith a recording of the transaction carried out at the FD 16 may begenerated and presented to the customer. A change delivery device 108may also be used to deliver change for overpayment to a customer. Adisplay 110 is used to provide information, such as transaction-relatedprompts and advertising, to the customer. Soft keys 112 are used by thecustomer to respond to information requests presented to the user viathe display 110. An intercom 114 is provided to generate audible cuesfor the customer and to allow the customer to interact with an operatoror attendant.

In addition, the FD 16 includes a transaction price total display 116that may be used to present the customer with the price to be charged tothe customer for fuel that is dispensed. A transaction gallon totaldisplay 118 may be used to present the customer with the measurement offuel dispensed in units of gallons or liters as a volume of fueldispensed from the FD 16. Octane selection buttons 120 are provided forthe customer to select which grade of fuel is to be dispensed beforedispensing is initiated. Price per unit (PPU) displays 122 are providedto show the price per unit of fuel dispensed in either gallons orliters, depending upon the programming of the FD 16. As will bedescribed in more detail below, a perpetrator attempting to commit fraudmay attempt to reprogram the FD 16 to associate a lower or zero PPU thanwhat is the actual cost of fuel.

FIG. 3 illustrates a block diagram of exemplary control system 18 thatmay be used to control access to a programming mode for the FD 16 forcontrolling entry into a programming mode of operation in response toreceipt of the AAPM signal either from a POS device, such the POSdevices 28 or 30, or from the SC 32. It should be noted that othercontrol elements that are associated with the FDs 16, such as certaincomponents of the user interface 90 (FIG. 2), are not illustrated withinFIG. 3 to allow the present description to focus on the components thatcontrol access to the programming mode for the FDs 16. The controlsystem 18 allows the FD 16 to communicate with the POS devices 28 and30, other FDs 16, and/or the SC 32 to complete transactions within theretail fueling environment 10.

The elements of the FD 16 that are depicted within FIG. 3 (e.g.,manager's keypads 20, PPU displays 122, etc.) are illustrated verticallyalong the top right side of FIG. 3. A system controller 130 isillustrated interconnected to these elements for interpreting orcontrolling functionality associated with these elements within the FD16. The system controller 130 operates to control access to theprogramming mode of operation for the FD 16.

A memory 132 is connected to the system controller 130. The memory 132may be used to store user transaction information that is associatedwith transactions within the retail fueling environment 10, such asidentification card data and/or fingerprint identification dataassociated with an active transaction. The memory 132 may also include aread only memory (ROM) 134, a random access memory (RAM) 136, and anon-volatile memory 138.

Additionally, a configuration storage area 140 is illustrated within thememory 132. The configuration storage area 140 is further illustrated asa magnified area on the lower right side of FIG. 3. As can be seen fromFIG. 3, configuration information that is associated with the FD 16 isillustrated within the configuration storage area 140.

Exemplary fields that are illustrated within the configuration storagearea 140 of FIG. 3 include an operating mode field 150, a drive offwarning field 152, a transaction log enable field 154, a calibrationvalues field 156, a zero price per unit (PPU) field 158, a PPU valuesfield 160, an authorization to access programming mode (AAPM) field 162,and an AAPM protocol field 164. Additional configuration fields arepossible. For ease of illustration, these additional fields are notincluded within FIG. 3. As will be described in more detail below, anAAPM protocol may be associated with generation of the AAPM signal tofurther enhance security.

As will be described in more detail below, upon receipt of an AAPMsignal at the FD 16 from one of the POS devices 28 and 30, the SC 32, orthe remote system 42, the AAPM field 162 is set to authorize access tothe programming mode of operation for the FD 16. Additionally, a timer166 is started to allow a duration of time to be measured from receiptof the AAPM signal until a request is issued to enter the programmingmode at the FD 16. This request to enter the programming mode ofoperation may be initiated, for example, via the manager's keypad 20 byany appropriate sequence of keystrokes.

The timer 166 may be an up-counting or down-counting timer, and mayfurther be interrupt driven such that an interrupt is generated to thesystem controller 130 upon expiration of the timer 166. Alternatively,the timer 166 may be polled without departure from the scope of thesubject matter described herein. If a request to enter the programmingmode of operation is not received prior to expiration of the timer 166,as will be described in more detail below in association with FIG. 5,the AAPM field 162 may be cleared and the FD 16 will thereafter beprevented from entering the programming mode of operation until a newAAPM signal is received. An exemplary timeout value for the timer 166may be five (5) minutes. A value similar this should be sufficientenough for the attendant or technician to issue the AAPM signal from aPOS device, such as one of the POS devices 28 and 30, and walk to the FD16 prior to expiration of the timer 166. Other timeout values may beselected with respect to physical separation of the POS devices 28and/or 30 from the FD 16 and other criteria, such as physical conditionof the attendant or technician.

Additionally, if a transaction is started by a customer at the FD 16during the window of time delineated by the timer period associated withthe authorization to enter the programming mode of operation, the FD 16will thereafter also be prevented from entering the programming mode ofoperation until a new AAPM signal is received. This will prevent the FD16 from maintaining a state of authorization to enter the programmingmode of operation, as will be described in more detail in associationwith FIG. 5 below, while a customer is using the FD 16. After thetransaction is completed, the attendant or technician can re-issue theAAPM signal to start the timer and to re-enter the authorization mode.

As described above, an augmented protocol may be associated with theAAPM signal to further enhance security and to verify that the AAPMsignal was actually generated by authorized personnel via one of the POSdevices 28 and 30, the SC 32, or the remote system 42. The augmentedprotocol may be developed such that the AAPM signal is either led and/orfollowed by additional signaling from the generating device thatoriginated the AAPM signal. For example, a certain number (e.g., three)of pump stop signals (not described in detail herein) may be generatedafter the AAPM signal to further distinguish and identify the AAPMsignal generated at one of the POS devices 28 and 30, the SC 32, or theremote system 42. In this way, verification of the AAPM signal may alsobe performed upon receipt of the AAPM signal and associated signaling,referred to as AAPM signaling, by the system controller 130 by verifyingthat the additional signaling associated with the augmented protocol ispresent. This augmented protocol may be altered from time to time tofurther increase security. Furthermore, the augmented protocol may bestored within the AAPM protocol field 164 and may be entered via themanager's keypad or downloaded to the FD 16 from one of the POS devices28 and 30, the SC 32, or the remote system 42.

The configuration storage area 140 may include any form of storagemedium, either alone or in combination, that is capable of storingconfiguration data for the FD 16, and may further be included within ROM134, RAM 136, and the non-volatile memory 138. For example, theconfiguration storage area 140 may include a variety of registers, RAM,non-volatile memory, or any combination of these types of storage. Theconfiguration storage area 140 may also include disk storage and mayfurther be remote from the FD 16 and accessible, for example, via the SC32. Furthermore, the configuration storage area 140 may be includedwithin the system controller 130 without departure from the scope of thesubject matter described herein.

Regarding the fields within the configuration storage area 140, theoperating mode field 150 may be used to place the FD 16 into theprogramming mode of operation. The operating mode field 150 may also beused to place the FD 16 into a stand-alone mode of operation that wouldnot need any authorization to dispense fuel. A perpetrator that isattempting to commit fraud would likely attempt to change the operatingmode field 150 via the manager's keypad or a hand-held programmingdevice to place the FD 16 into the programming mode of operation andthen to place the FD 16 into the stand-alone mode of operation. Ifsuccessful, the perpetrator would be able to dispense fuel by causingthe fuel dispenser to open the valve 80. In this scenario, the PPUdisplays 122 would remain unchanged. The pulser 76 would generate pulsesbased upon fuel flow and the display 110, the transaction price totaldisplay 116, and the transaction gallon total display 118 would updateas initially programmed by the attendant or technician.

However, when coupled with the AAPM signaling as described hereingenerated by one of the POS devices 28 and 30 or the SC 32, theperpetrator would be unable to cause the FD 16 to enter the programmingmode of operation by conventional means. Accordingly, fraud may beprevented at the FD 16 by use of the AAPM signaling.

Other exemplary problems with conventional fuel dispensers that aresolved by use of the description herein include preventing changes toother fields within the configuration storage area 140. For a conventionfuel dispenser, once placed into the programming mode of operation, theperpetrator may further conceal fraud by performing other configurationchanges to the conventional fuel dispenser. For example, the perpetratorcould turn the drive off warning field 152 to an “off” state, therebydisabling any drive off warning indication that the attendant mayotherwise receive. Additionally, the transaction log enable field 154that stores records of transactions at the conventional fuel dispensercould be altered or disabled when in the programming mode of operation.Calibration values field 156 and or PPU values field 160 could bealtered which would result in different values being displayed on PPUdisplays 122, the display 110, the transaction price total display 116,and the transaction gallon total display 118. As another example, thezero PPU field 158 may be set to cause the price per unit of fuel to bezero. All of these types of fraud may be prevented within the FD 16 byuse of the AAPM signaling described herein.

FIG. 4 illustrates an exemplary process that may be executed on a POSdevice, such as the POS devices 28 and 30, the SC 32 with a POSinterface, the remote system 42, or the wireless device 23 to facilitateprotection from fraud within the retail fueling environment 10 byproviding the AAPM signal to the FD 16 in response to an input selectionby the attendant or technician requesting that the AAPM signal begenerated. Initially, the process starts (step 400). The process thenwaits for a request to generate and send the AAPM signal to a FD 16(decision point 402). This request may include an identifier that isassociated with the FD 16 to allow the AAPM signal to be directed towarda specific FD 16. Alternatively, the request may include a request tobroadcast the AAPM signal to multiple FDs 16 within the retail fuelingenvironment 10. In either case, the AAPM signal may be directed to theappropriate FDs 16, as described in more detail below.

Upon receipt of a request to send the AAPM signal to a FD 16, theprocess retrieves the current AAPM protocol from storage (step 404). Asdescribed above with respect to FIG. 3, multiple signaling options maybe associated with the AAPM signal generation such that additionalsignaling may be generated prior to or after the AAPM signal. Based uponthe current AAPM protocol, the signaling may be varied to furtherincrease fraud protection within the retail fueling environment 10.

The process determines, based upon the current protocol that has beenretrieved, whether signaling is to be generated prior to the AAPM signal(decision point 406). When signaling is to be generated prior to theAAPM signal, the process performs the appropriate pre-signaling (step408). As described above, this may include sending additional signals,such as fuel dispenser “stop” signals, to the FD 16. Other signalingoptions are possible. Additionally, any number of additional signals,such as three (3) stop signals, may be sent to the FD 16. The FD 16 maymonitor the incoming signaling and activate a process to receive theAAPM signal, as described in more detail below in association with FIG.5, upon detecting the pre-signaling sequence that is associated with thecurrent AAPM protocol.

When pre-signaling is not to be generated prior to the AAPM signal orafter the appropriate signaling is generated, the process sends the AAPMsignal to the FD 16 (step 410). The process then determines, based uponthe current protocol that has been retrieved, whether signaling is to begenerated after the AAPM signal (decision point 412). When signaling isto be generated after the AAPM signal, the process performs theappropriate post-signaling (step 414). As described above, this mayinclude sending additional signals, such as fuel dispenser “stop”signals, to the FD 16. Other signaling options are possible.Additionally, any number of additional signals, such as three (3) stopsignals, may be sent to the FD 16. The FD 16 may monitor the incomingsignaling and ensure that proper post-signaling is received, asdescribed in more detail below in association with FIG. 5, prior toallowing entry into the programming mode of operation. Whenpost-signaling is not to be generated after the AAPM signal or after theappropriate signaling is generated, the process returns to await a newrequest to send the AAPM signal (decision point 402).

FIG. 5 illustrates an exemplary process that may be executed on the FD16 and that responds to the AAPM signaling generated by the process ofFIG. 4 to facilitate protection from fraud within the retail fuelingenvironment 10 by preventing the FD 16 from being placed into theprogramming mode of operation at times other than during a window oftime after receipt of the AAPM signal. Initially, the process starts(step 500). The process retrieves the current AAPM protocol from eithera remote source, such as the SC 32 or one of the POS terminals 28 and30, or from memory, such as the AAPM protocol field 164 of the memory132 (step 502). If retrieved from a remote source, the process may alsostore the received protocol (not illustrated) within the AAPM protocolfield 164.

As described above in association with FIG. 4, pre-signaling may occurduring generation and transmission of the AAPM signal depending upon thecurrent AAPM protocol. Accordingly, the process determines whetherpre-signaling is used in the current AAPM protocol (decision point 504).When pre-signaling is used in the current AAPM protocol, the processwill wait for appropriate pre-signaling to be received (decision point506). When either appropriate pre-signaling is received or whenpre-signaling is not used for the current AAPM protocol, the processwill wait for the AAPM signal to be received (decision point 508). Itshould be noted that appropriate error handling procedures may beemployed to manage any timeout or other error conditions associated withany of the stages of the processes described herein.

When the AAPM signal is received, the process will determine whetherpost-signaling is used with the current AAPM protocol (decision point510). When post-signaling is used in the current AAPM protocol, theprocess will wait for appropriate post-signaling to be received(decision point 512). When either appropriate post-signaling is receivedor when post-signaling is not used for the current AAPM protocol, theprocess will enable access into the programming mode of operation bysetting the AAPM field 162 (step 514). The process will also set atimer, such as the timer 166, to measure an amount of time after receiptof the AAPM signal (step 516). It should be noted that the AAPM field162 and the timer 166 may be set at another point during the process,such as after receipt of the AAPM signal (decision point 508), withoutdeparture from the scope of the subject matter described herein.

As described above, this timer may be an up-counting timer, adown-counting timer, interrupt driven or polled without departure fromthe scope of the subject matter described herein. The timer effectivelycreates a window of opportunity for the attendant or technician to placethe FD 16 into a programming mode of operation. After expiration of thetimer or upon initiation of a transaction by a customer, as will bedescribed in more detail below, the FD 16 will no longer be authorizedto be placed into a programming mode of operation without a new AAPMsignal being received.

The present description assumes that the attendant or technician hasobserved that there is not an ongoing transaction at the FD 16 prior toissuing the AAPM signaling. However, if an active transaction is inprocess at the FD 16 when the AAPM signal is issued, appropriate errorsignaling may be generated and issued to the AAPM signaling source toalert the attendant or technician that a transaction is currently inprocess at the FD 16.

After setting the AAPM field 162 (step 514) and the timer 166 (step516), the process then determines whether the timer has expired(decision point 518). When the process has determined that the timer hasnot expired, the process determines whether a transaction has beeninitiated at the FD 16 (decision point 520). When a transaction has notbeen initiated at the FD 16, the process determines whether a request toenter the programming mode of operation has been initiated by theattendant or technician (decision point 522). As described above, themanager's keypad 20 may be used to initiate a request to enter theprogramming mode of operation by any suitable key combination. The codeused to enter the programming mode of operation may also be altered whenthe FD 16 is in the programming mode of operation by any suitable means,such as entry of programming information via the manager's keypad 20.

When a request to enter the programming mode of operation has not beeninitiated (decision point 522), the process iterates to determinewhether the timer has expired (decision point 518), whether atransaction has been initiated (decision point 520), and whether arequest to enter the programming mode of operation has been received(decision point 522). When a determination is made that the timer hasexpired (decision point 518), the process will clear the AAPM field 162(step 524) and return to retrieve the current protocol (step 502) andcontinue as described above. Likewise, when a determination is made thata transaction has been initiated (decision point 520), the process willalso clear the AAPM field 162 (step 524) and return to retrieve thecurrent protocol (step 502) and continue as described above.

When a request to enter the programming mode of operation has beenreceived (decision point 522) and the timer 166 has not expired and atransaction has not been initiated at the FD 16, the process willdetermine whether authorization to enter the programming mode has beenreceived (decision point 526). Should there be a system malfunction orother problem with the FD 16, such as a memory problem, the AAPM field162 may not be set. Accordingly, if it is determined that the authorizedto enter programming mode field 162 is not set or is corrupted, theprocess will perform an action to clear the AAPM field 162 (step 524)and return to retrieve the current protocol (step 502) and continue asdescribed above. When a determination is made that the AAPM field 162 isset and that programming has been authorized and is still allowed(decision point 526), the process will reset the timer 166 (step 528).The timer 166 may be used and set in this situation to an amount of timesufficient to allow most programming operations to be completed at theFD 16. Accordingly, the timer 166 may be used, as will be described inmore detail below, to remove the FD 16 from the programming mode ofoperation should the attendant or technician fail to remove the FD 16from the programming mode of operation during the programming sequence.The process will then enter the programming mode of operation (step530).

It should be noted that use of the AAPM field 162 may be optional forpurposes of the functionality with respect to controlling access to theprogramming mode of operation for the FD 16. The timer 166 may be usedas described above to manage entry into and exit from the programmingmode of operation for the FD 16 without use or maintenance of the AAPMfield 162. Use of the AAPM field 162 is described to demarcate thewindow of opportunity within which programming may be performed.Accordingly, additional uses for the AAPM field 162 are envisioned. Forexample, a flag may be either logged with a time stamp and/or polledfrom a remote source, such as the SC 32 or one of the POS devices 28 and30, for maintenance and/or troubleshooting purposes when one of theremote sources has been used to issue a request to enter the programmingmode of operation. Furthermore, the AAPM field 162 may be used by theattendant or technician while at the FD 16 to verify that the FD 16 wasplaced into the programming mode of operation by a previously-issuedrequest.

For ease of illustration, detailed representations of programmingoperations will not be described herein. FIG. 3 describes certainexemplary fields that may be programmed for the FD 16 during theprogramming mode of operation. Additional fields may be employed andmultiple programming levels may be employed with higher levels ofprogramming associated with more critical programming fields withoutdeparture from the scope of the subject matter described herein. Assuch, the process will determine whether the attendant or technician hasindicated that programming is complete (decision point 532). Thisindication that programming is complete may be entered by the attendantor technician at the manager's keypad 20. The process will alsodetermine whether the timer 166 has expired (decision point 534) andwill determine whether a transaction has been started at the FD 16(decision point 536).

The process may use a determination that the timer 166 has expired orthat a transaction has been initiated to signal that the attendant ortechnician did not properly exit the programming mode of operation.Furthermore, if a transaction is initiated while the FD 16 is in theprogramming mode of operation, an appropriate error or alarm conditionmay be signaled to the attendant or technician and logging may be usedto capture information associated with the transaction, such as priceper unit, quantity dispensed and related information.

The process will iterate between determining whether programming iscomplete (decision point 532), whether the timer 166 has expired(decision point 534), and whether a transaction has been started(decision point 536) until one of the three conditions is true.

When the timer 166 has expired, the programming is complete, or atransaction is started, the process will exit the programming mode (step538), clear the AAPM field 162 (step 524), return to retrieve thecurrent AAPM protocol (step 502), and continue as described above.Because the current AAPM protocol field 164 is one field that may beprogrammed during the programming mode of operation, retrieving thecurrent AAPM protocol will ensure that the most recently programmed AAPMprotocol is used.

As described above, the wireless device 23 may be used by an attendant,technician, or other authorized personnel as an authorization terminalto generate the AAPM signal and any associated signaling included withinan AAPM protocol from a location proximate to the FDs 16 to allow theauthorized person to place any of the FDs 16 into the programming modeof operation without having to repeatedly travel between the centralbuilding 12 and the FDs 16 to generate the AAPM signaling from one ofthe POS devices 28 and 30 or the SC 32, or to repeatedly request thatthe remote system 42 generate the AAPM signaling.

Those skilled in the art will recognize improvements and modificationsto the preferred embodiments of the present invention. All suchimprovements and modifications are considered within the scope of theconcepts disclosed herein and the claims that follow.

What is claimed is:
 1. A method for preventing fraud by a customer at afuel dispenser within a retail fueling environment, comprising:receiving an authorization to access programming mode (AAPM) signal atthe fuel dispenser from an authorization terminal separate from the fueldispenser; receiving a request from a second terminal located at thefuel dispenser to enter a programming mode of operation (PMO); andentering the PMO at the fuel dispenser to allow fuel dispenser settingsof the fuel dispenser to be changed after receiving the AAPM signal andthe request to enter the PMO.
 2. The method of claim 1 furthercomprising preventing the fuel dispenser from being placed into the PMOprior to it receiving the AAPM signal.
 3. The method of claim 1 furthercomprising measuring, in response to receiving the AAPM signal, a firsttime period.
 4. The method of claim 3 further comprising determiningwhether the first time period has expired.
 5. The method of claim 4further comprising preventing the fuel dispenser from being placed intothe PMO if a fuel dispensing transaction is initiated by the customer atthe fuel dispenser or if the first time period has expired before therequest to enter the PMO is received.
 6. The method of claim 4 whereinmeasuring the first time period further comprises starting a timer todetermine when the first time period has expired.
 7. The method of claim6 wherein starting the timer further comprises reading a current timervalue of the timer and determining whether the first time period hasexpired further comprises comparing an elapsed period of time relativeto the current timer value.
 8. The method of claim 6 wherein the timeris selected from a group consisting of an up-counting timer and adown-counting timer.
 9. The method of claim 6 wherein determiningwhether the first time period has expired further comprises an actionselected from the group consisting of polling the timer and receiving aninterrupt from the timer.
 10. The method of claim 1 further comprisingmeasuring a time period representative of a time that the fuel dispenseris in the PMO.
 11. The method of claim 10 wherein measuring the timeperiod further comprises starting a timer upon entering the PMO.
 12. Themethod of claim 10 further comprising exiting the PMO if a request toexit the PMO has not been received by an expiration of the time period.13. The method of claim 1 further comprising receiving a request to exitthe PMO.
 14. The method of claim 13 further comprising exiting the PMO.15. The method of claim 1 wherein the authorization terminal is selectedfrom a group consisting of a point-of-sale (POS) device, a sitecontroller, a remote system, and a wireless device.
 16. The method ofclaim 1 wherein the request to enter the PMO is received via a manager'skeypad located within a compartment of the fuel dispenser that is notaccessible by the customer.
 17. The method of claim 1 further comprisingallowing programming parameters of the fuel dispenser to be changedwhile the fuel dispenser is in the PMO.
 18. The method of claim 17wherein the programming parameters include an operating mode, adrive-off warning, a transaction log enable setting, calibration valuesfor the fuel dispenser, a zero price-per-unit (zero PPU) option, and PPUvalues.
 19. The method of claim 1 further comprising selecting an AAPMprotocol and wherein receiving the AAPM signal further comprisesreceiving additional signaling other than the AAPM signal in associationwith receiving the AAPM signal as part of the AAPM protocol.
 20. Themethod of claim 19 further comprising receiving the additional signalingbefore the AAPM signal as part of the AAPM protocol to indicate that theAAPM signal is forthcoming.
 21. The method of claim 20 wherein receivingthe additional signaling before the AAPM signal includes receiving atleast one pump stop signal before receiving the AAPM signal.
 22. Themethod of claim 20 further comprising verifying proper receipt of theAAPM signal using the AAPM protocol.
 23. The method of claim 19 furthercomprising receiving signaling after the AAPM signal as part of the AAPMprotocol to indicate that the AAPM signal should have been received. 24.The method of claim 19 wherein the AAPM signal and the AAPM protocol arereceived from a point-of-sale (POS) device within the retail fuelingenvironment.